- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

Hi
can I get user risk score in UBA from Splunk ES search command, given the user name.
Thanks,
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

Not directly, no. However, Splunk ES can ingest anomalies and threats, which can then impact the ES risk score. Out of the box, we will increase the ES risk score for any threats, and you could easily create a new correlation search looking for the anomalies (index=ueba uba_evt_type=anomaly
if my memory serves) that would not create a notable event, but would create a risk entry. That would allow anomalies to also impact your ES risk score.
Does that seem like it might meet your needs?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

Not directly, no. However, Splunk ES can ingest anomalies and threats, which can then impact the ES risk score. Out of the box, we will increase the ES risk score for any threats, and you could easily create a new correlation search looking for the anomalies (index=ueba uba_evt_type=anomaly
if my memory serves) that would not create a notable event, but would create a risk entry. That would allow anomalies to also impact your ES risk score.
Does that seem like it might meet your needs?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

Hello,
How about to get daily dynamic lookup from UBA containing high-risk user? is it possible?
thanks again
